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DETAILED ACTION 

This final action is in response to the amendment filed on 09/21/2007. The examiner 
acknowledges the amendments made to Claims 1, 4, 7, 10, 13, 16, 19, 22, 25, 28, 31, 34, 36, 37, 
& 39 and the cancellation of Claims 2, 5, 6, 8, 11, 12, 14, 17, 18, 20, 23, 24, 26, 29, 30, 32, 35, & 
38. In light of the applicant's amendments, the examiner hereby withdraws his objections to the 
specification and Claims 4 & 10; and the 35 U.S.C. 1 12 rejections regarding Claims 35-39. 
Claims 1, 3, 4, 7-10, 13, 15, 16, 19, 21, 22, 25, 27, 28, 31, 33, 34, 36, 37 and 39 are pending and 
have been considered as follows. 

Claim Rejections - 35 USC § 103 

1 . The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1, 7, 13, 19, 25, 31, 34, & 37 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Allison ("pwdimip - Windows NT password hash retrieval") in view of Guski 
et al. (US-5592553-A). 
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Claim 1: 

Allison discloses a computer program product, comprising a computer readable medium storing 
computer executable instructions for controlling a processor comprising, 

- "receiving a request from a user to obtain a file from a database" (i.e. "/* *Open a 
connection to the remote machines registry. */") [pages 16-17]; 

- "wherein the user is associated with a user name" (i.e. "/* * Ensure we are running as 
Administrator before * we will run. */") [page 16]; 

- "obtaining, in response to the request, a file dump associated with the database" (i.e. 
"dumps the password database of an NT machine that is held in the NT registry (under 
HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) into a valid 
smbpasswd format file") [page 1]; 

- "wherein the file dump comprises an encrypted database password" (i.e. "security = user 
encrypted passwords = yes") [page 2]; 

- "decrypting the ehcrypted database password to obtain a database password" (i.e. "As 
this code decrypts the obfiiscication step in the NT password database") [page 2]; 

- "wherein the database password comprises a hash value derived fi-om the user name and 
password" (i.e. "allowing a larunan and md4 hash to be written into the NT registry for a 
user account") [page 2]; 

- "wherein the password is associated with the user" (i.e. "account password") [page 2]; 
but Allison does not disclose, 

- "obtaining a temporary user name based on the user name" 
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- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "accessing the database using the temporary user name and the database password to 
obtain the file" 

however, Guski et aL do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees With the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining a temporary user name based on the user name" and 
"wherein access rights associated with the user name are greater than access rights associated 
with the temporary user name" and "accessing the database using the temporary user name and 
the database password to obtain the file," in the invention as disclosed by Allison for the 
purposes of having ""one-time" or "dynamic" passwords that are valid for only a brief time 
interval (e.g., a minute or less), so that interception of such a password during one interval 
provides no useful information for gaining access to a system during a later interval" [column 1 
lines 41-45]. 
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Claim 7: 

Allison discloses a computer program product, comprising a computer readable medium storing 
computer executable instructions for controlling a processor comprising, 

- "initiating a signon attempt to a database" (i.e. "/* *Open a connection to the remote 
machines registry. */") [pages 16-17]; 

- "the signon attempt failing to connect" (i.e. "By default it will dump the password 
database of the local machine") [page 2]; 

- "wherein the failed signon attempt triggers an embedded mechanism within the database 
to dump an encrypted database password into a file" (i.e. "dumps the password database 
of an NT machine that is held in the NT registry (under 

HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) into a valid 
smbpasswd format file") [page 1]; 

- "reading the file to obtain the encrypted database password" (i.e. "NTCrack. Or you can 
get lOphtcrack") [page 1]; 

- "decrypting the encrypted database password to obtain a database password" (i.e. 
"NTCrack. Or you can get lOphtcrack") [page 1]; 

- "wherein the database password comprises a hash value derived from a user name and 
password" (i.e. "allowing a lanman and md4 hash to be written into the NT registry for a 
user account") [page 2]; 

- "wherein the password is associated with the user name" (i.e. "account password") [page 

2]; 
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but Allison does not disclose, 

- "obtaining a temporary user name based on the user name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "accessing the database using the temporary user name and the database password" 
however, Guski et al do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining a temporary user name based on the user name" and 
"wherein access rights associated with the user name are greater than access rights associated 
with the temporary user name" and "accessing the database using the temporary user name and 
the database password," in the invention as disclosed by Allison for the purposes of having 
""one-time" or "dynamic" passwords that are valid for only a brief time interval (e.g., a minute or 
less), so that interception of such a password during one interval provides no useful information 
for gaining access to a system during a later interval" [column 1 lines 41-45]. 



Application/Control Number: Page 7 

10/821,774 

Art Unit: 2136 

Claim 13: 

Allison discloses a computer program product for controlling a processor to connect to a 
database comprising, 

- "a computer readable medium" (i.e. "an NT machine that is held in the NT registry") 
[page 1]; 

- "an attempted signon module stored on the computer readable medium" (i.e. "/* *Open a 
connection to the remote machines registry. */") [pages 16-17]; 

- "the attempted signon module configured to communicate with the database to initiate a 
signon attempt to the database" (i.e. "/* *Open a connection to the remote machines 
registry. ♦/") [pages 16-17]; 

- "a read module stored on the computer readable medium configured to read a file 
dumped .by the database" (i.e. "NTCrack. Or you can get lOphtcrack") [page 1]; 

- "the file comprising an encrypted database password" (i.e. "security = user encrypted 
passwords = yes") [page 2]; 

- "wherein the file is received in response to a failed sign on attempf ' (i.e. "dumps the 
password database of an NT machine that is held in the NT registry (under 
HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) into a valid 
smbpasswd format file") [page 1]; 

- "a decryption module stored on the computer readable medium configured to decrypt the 
encrypted database password to obtain a database password" (i.e. "NTCrack. Or you can 
get lOphtcrack") [page 1]; 
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- "wherein the database password comprises a hash value derived from a user name and 
password" (i.e. "allowing a lanman and md4 hash to be written into the NT registry for a 
user account") [page 2]; 

- "wherein the password is associated with the user name" (i.e. "account password") [page 
2]; 

but Allison does not disclose, 

- "a temporary signon module stored on the computer readable medium" 

- "the temporary signon module configured to communicate with the database to initiate a 
user session with the database to obtain a temporary user name based on the user name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "a pass connect string module stored on the computer readable medium" 

- "the pass connect string module configured to communicate with the database to pass a 
connect string to a database tool" 

- "the connect string comprising the database password" 

- "wherein the database, upon receipt of the connect string, allows the database tool to 
query the database" 

however, Guski et al. do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
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dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & colunrm 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [colunin 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "a temporary signon module stored on the computer readable 
medium" and "the temporary signon module configured to communicate with the database to 
initiate a user session with the database to obtain a temporary user name based on the user name" 
and "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" and "a pass connect string module stored on the 
computer readable medium" and "the pass connect string module configured to communicate 
with the database to pass a connect string to a database tool" and "the connect string comprising 
the database password" and "wherein the database, upon receipt of the connect string, allows the 
database tool to query the database," in the invention as disclosed by Allison for the purposes of 
having ""one-time" or "dynamic" passwords that are valid for only a brief time interval (e.g., a 
minute or less), so that interception of such a password during one interval provides no useful 
information for gaining access to a system during a later interval" [column 1 lines 41-45]. 



Application/Control Number: Page 10 

10/821,774 

Art Unit: 2136 

Claim 19: 

Allison discloses a method for controlling a processor to connect to a database comprising, 

- "executing a launcher program" (i.e. "NTCrack. Or you can get lOphtcrack") [page 1]; 

- "reading, using the launcher program, a file dumped fi-om the database" (i.e. "NTCrack. 
Or you can get lOphtcrack") [page 1]; 

- "wherein the file comprises an encrypted database password" (i.e. "security = user 
encrypted passwords = yes") [page 2]; 

- "decrypting the encrypted database password to obtain a database password" (i.e. 
"NTCrack. Or you can get lOphtcrack") [page 1]; 

- "wherein the database password comprises a hash value derived fi-om a user name and 
password" (i.e. "allowing a lanman and md4 hash to be written into the NT registry for a 
user account") [page 2]; 

- "wherein the password is associated with the user name" (i.e. "account password") [page 

2]; 

but Allison does not disclose, 

- "obtaining a temporary user name based on the user name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary, user name" 

- "accessing the database using the temporary user name and the database password" 
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however, Guski et al. do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [colunm 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining a temporary user name based on the user name" and 
"wherein access rights associated with the user name are greater than access rights associated 
with the temporary, user name" and "accessing the database using the temporary user name and 
the database password," in the invention as disclosed by Allison for the purposes of having 
""one-time" or "dynamic" passwords that are valid for only a brief time interval (e.g., a minute or 
less), so that interception of such a password during one interval provides no useful information 
for gaining access to a system during a later interval" [column 1 lines 41-45]. 
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Claim 25: 

Allison discloses a method for controlling a processor to connect to a database comprising, 

- "initiating a signon attempt to a database" (i.e. "/* *Open a connection to the remote 
machines registry. */") [pages 16-17]; 

- "the signon attempt failing to connect" (i.e. "By default it will dump the password 
database of the local machine") [page 2]; 

- "reading the file to obtain the encrypted database password" (i.e. "NTCrack. Or you can 
get lOphtcrack") [page 1]; 

- "decrypting the encrypted database password to obtain a database password" (i.e. 
"NTCrack. Or you can get lOphtcrack") [page 1]; 

- "wherein the database password comprises a hash value derived from a user name and 
password" (i.e. "allowing a lanman and md4 hash to be written into the NT registry for a 
user account") [page 2]; 

- "wherein the password is associated with the user name" (i.e. "account password") [page 
2]; 

but Allison does not' disclose, 

- "obtaining a temporary user name based on the user name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "accessing the database using the temporary user name and the database password" 
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however, Guski et aL do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees vAth the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining a temporary user name based on the user name" and 
"wherein access rights associated with the user name are greater than access rights associated 
with the temporary user name" and "accessing the database using the temporary user name and 
the database password," in the invention as disclosed by Allison for the purposes of having 
""one-time" or "dynamic" passwords that are valid for only a brief time interval (e.g., a minute or 
less), so that interception of such a password during one interval provides no useful information 
for gaining access to a system during a later interval" [column 1 lines 41-45]. 
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Claim 31: 

Allison discloses a computer program product, comprising a computer readable medium storing 
computer executable instructions for controlling a processor comprising, 

- "hashing a user name and password to create a database password" (i.e. "it may be 
reversed, allowing a lanman and md4 hash to be written into the NT registry for a user 
account") [page 2]; 

- "encrypting the database password to create an encrypted database password" (i.e. 
"security = user encrypted passwords = yes") [page 2]; 

- "storing the encrypted database password in a database" (i.e. "the password databases") 
[page 2]; 

- "receiving a signon attempt for the database" (i.e. "/* *Open a connection to the remote 
machines registry. */") [pages 16-17]; 

- "wherein the signon attempt fails" (i.e. "By default it will dump the password database of 
the local machine") [page 2]; 

- "dumping a file comprising the encrypted password in response to the failed signon 
attempt" (i.e. "dumps the password database of an NT machine that is held in the NT 
registry (under HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) 
into a valid smbpasswd format file") [page 1]; 

- "decrypting the encrypted database password to obtain the database password" (i.e. 
"NTCrack. Or you can get lOphtcrack") [page 1]; 
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but Allison does not disclose, 

- "obtaining a temporary user name based on the user name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "accessing the database using the temporary user name and the database password" 
however, Guski et al. do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining a temporary user name based on the user name" and 
"wherein access rights associated with the user name are greater than access rights associated 
with the temporary user name" and "accessing the database using the temporary user name and 
the database password," in the invention as disclosed by Allison for the purposes of having 
""one-time" or "dynamic" passwords that are valid for only a brief time interval (e.g., a minute or 
less), so that interception of such a password during one interval provides no useful information 
for gaining access to a system during a later interval" [column 1 lines 41-45]. 
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Claim 34: 

Allison discloses a computer program product for controlling a processor to connect to a 
database comprising, 

- "a computer readable medium" (i.e. "an NT machine that is held in the NT registry") 
[page 1]; 

- "a hash module stored on the computer readable medium configured to hash a user name 
and password to create a database password" (i.e. "it may be reversed, allowing a lanman 
and md4 hash to be written into the NT registry for a user account") [page 2]; 

- "an encryption module stored on the computer readable medium configured to encrypt 
the database password to create an encrypted database password" (i.e. "security = user 
encrypted passwords = yes") [page 2]; 

- "a store module stored on the computer readable medium" (i.e. "an NT machine that is 
held in the NT registry") [page 1]; 

- "the store module configured to communicate with a database to store the encrypted 
database password in the database" (i.e. "the password databases") [page 2]; 

- "a send module stored on the computer readable medium" (i.e. "a 'AT job on your NT 
server to periodically dump your NT password database into a new smbpasswd file and 
copy it over (securely somehow) to the Samba server") [page 1]; 

- "the send module configured to conununicate with a launcher application to send the 
encrypted database password file to the launcher application" (i.e. "copy it over (securely 
somehow) to the Samba server") [page 1]; 
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- "a launcher application stored on the computer readable medium" (i.e. "NTCrack. Or you 
can get lOphtcrack") [page 1]; 

- "configured to: decrypt the encrypted database password to obtain a database password" 
(i.e. "NTCrack. Or you can get lOphtcrack") [page 2]; 

but Allison does not disclose, 

- "configured to: obtain a temporary user name based on the user name" 
"wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "configured to: access the database using the temporary user name and the database 
password" 

however, Guski et al. do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [colunm 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "configured to: obtain a temporary user name based on the user 
name" and "wherein access rights associated with the user name are greater than access rights 
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associated with the temporary user name" and "configured to: access the database using the 
temporary user name and the database password," in the invention as disclosed by Allison for the 
purposes of having ""one-time" or "dynamic" passwords that are valid for only a brief time 
interval (e.g., a minute or less), so that interception of such a password during one interval 
provides no useful information for gaining access to a system during a later interval" [column 1 
lines 41-45]. 
Claim 37: 

Allison discloses a method for controlling a processor to connect to a database and a launcher 
application comprising, 

- "hashing a user name and password to create a database password" (i.e. "it may be 
reversed, allowing a lanman and md4 hash to be written into the NT registry for a user 
account") [page 2]; 

- "encrypting the database password to create an encrypted database password" (i.e. 
"security = user encrypted passwords = yes") [page 2]; 

- "storing the encrypted database password in a database" (i.e. "the password databases") 
[page 2]; ^ 

- "receiving a signon attempt for the database" (i.e. "/* *Open a connection to the remote 
machines registry. */") [pages 16-17]; 

- "wherein the signon attempt fails" (i.e. "By default it will dump the password database of 
the local machine") [page 2]; 
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- "dumping a file comprising the encrypted password in response to the failed signon 
attempt" (i.e. "dumps the password database of an NT machine that is held in the NT 
registry (under HKEY_LOCAL_MACHINE\SECURITY\SAM\Domains\Account\Users) 
into a valid smbpasswd format file") [page 1]; 

- "decrypting, using the launcher application, the encrypted database password to obtain 
the database password" (i.e. "NTCrack. Or you can get lOphtcrack") [page 1]; 

but Allison does not disclose, 

- "obtaining, using the launcher application, a temporary user name based on the user 
name" 

- "wherein access rights associated with the user name are greater than access rights 
associated with the temporary user name" 

- "accessing the database using the temporary user name and the database password" 
however, Guski et al. do disclose, 

- "Systems of the type described in these references generate their one-time passwords as a 
function of secret information (such as a user password or an encryption key), time- 
dependent information such as a time-of-day (TOD) value or a time/date value, and, 
optionally, nonsecret information such as a user ID and application ID" [column 1 lines 
64-67 & column 2 lines 1-2]; 

- "IBM Resource Access Control Facility (RACF)" [column 6 line 52]; 

- "If the transmitted password agrees with the comparison password, the user is 
authenticated and granted access to the system resource" [column 2 lines 7-9]; 
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Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "obtaining, using the launcher application, a temporary user 
name based on the user name" and "wherein access rights associated v^th the user name are 
greater than access rights associated with the temporary user name" and "accessing the database 
using the temporary user name and the database password," in the invention as disclosed by 
Allison for the purposes of having ""one-time" or "dynamic" passwords that are valid for only a 
brief time interval (e.g., a minute or less), so that interception of such a password during one 
interval provides no useful information for gaining access to a system during a later interval" 
[column 1 lines 41-45]. 

3. Claims 3, 4, 15, 16, 21, 22, 27, 28, 33, 36, & 39 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Allison ("pwdump - Windows NT password hash retrieval") in view of 
Guski et al. (US-5592553-A) and in further view of Kaufman et al. (US-5418854-A1). 
Claims 3, 4, 9, 10, 15, 16, 27, & 28: 

Allison and Guski et al. disclose a computer program product, comprising a computer readable 
medium storing computer executable instructions for controlling a processor, a computer 
program product, comprising a computer readable medium storing computer executable 
instructions for controlling a processor, a computer program product for controlling a processor 
to connect to a database, a method for controlling a processor to connect to a database, and a 
method for controlling a processor to connect to a database, as in Claims 1, 7, 13, 19, & 25, but 
their combination do not disclose, 
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- "wherein the database password is encrypted with a public key" 

- "wherein decrypting the encrypted database password is accomplished using a private 
key associated with the public key" 

however, Kaufman et al. do disclose, 

- "A well-known cryptographic technique used to perform remote authentication is public 
key cryptography. In this method of secure communication, each principal has a public 
encryption key and a private encryption key, and two principals can communicate 
knowing only each other's public keys" [column 2 lines 14-16]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "wherein the database password is encrypted with a public key" 
and "wherein decrypting the encrypted database password is accomplished using a private key 
associated with the public key," in the invention as disclosed by Allison and Guski et al. since 
public key/private key pair cryptography is a common scheme of encryption for protecting 
information. 
Claim 33: 

Allison and Guski et al. disclose a computer program product, comprising a computer readable 
medium storing computer executable instructions for controlling a processor, as in Claim 31, but 
their combination do not disclose, 

- "wherein the encrypted password is encrypted with a public key" 
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hovyever, Kaufman et al. do disclose, 

- "A well-known cryptographic technique used to perform remote authentication is public 
key cryptography. In this method of secure communication, each principal has a public 
encryption key and a private encryption key, and two principals can communicate 
knowing only each other's public keys" [column 2 lines 14-16]; 

Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "wherein the encrypted password is encrypted with a public 
key," in the invention as disclosed by Allison and Guski et aL since public key/private key pair 
cryptography is a common scheme of encryption for protecting information. 
Claims 36 & 39: 

Allison and Guski et al. disclose a computer program product for controlling a processor to 
connect to a database and a method for controlling a processor to connect to a database and a 
launcher application, as in Claims 34 & 37, but their combination do not disclose, 

- "wherein the database password is encrypted with a public key" 

- "wherein the launcher application comprises a private key associated with the public key" 

- "wherein the launcher application decrypts the encrypted database password using the 
private key" 

however, Kaufman et aL do disclose, 

- "A well-known cryptographic technique used to perform remote authentication is public 
key cryptography. In this method of secure communication, each principal has a public 
encryption key and a private encryption key, and two principals can communicate 
knowing only each other's public keys" [column 2 lines 14-16]; 
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Therefore, it would have been obvious for one of ordinary skill in the art at the time of the 
applicant's invention to include, "wherein the database password is encrypted with a public key" 
and "wherein the launcher application comprises a private key associated with the public key" 
and "wherein the launcher application decrypts the encrypted database password using the 
private key," in the invention as disclosed by Allison and Guski et al. since public key/private 
key pair cryptography is a common scheme of encryption for protecting information. 

Conclusion 

4. Applicant's amendment necessitated the new ground(s) of rejection presented in this 
Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). 
Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated fi-om the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS fi-om the date of this 
final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Examiner Oscar Louie whose telephone number is 571-270-1684. 
The examiner can normally be reached Monday through Thursday from 7:30 AM to 4:00 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser Moazzami, can be reached at 571-272-4195. The fax phone number for 
Formal or Official faxes to Technology Center 2100 is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private 
PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you 
would like assistance from a USPTO Customer Service Representative or access to the 
automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 
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Nasser Moazzami 
Supervisory Patent Examiner 




